VULNERABILITY INTELLIGENCE

CVE-2026-35629

CVSS score5.3 MEDIUM
EPSS probability0.24%
CISA KEVNot currently listed
Published2026-04-09
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Description

OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs against SSRF attacks. Attackers can exploit unprotected fetch() calls against configured endpoints to rebind requests to blocked internal destinations and access restricted resources.

Weakness classification

  • CWE-918: Server-Side Request Forgery (SSRF)

Primary references